fix: optimize validation args

[drey]

Summary

Removes the --local-resource-validation flag together with its
ResourceValidationOptions.LocalResourceValidation option and the plumbing that
carried it into the kubeconform validator. Embedded-schemas-only validation is
still fully reachable — it is now simply the default, achieved by not passing
--resource-validation-extra-schema.

Why

After the validation schemas were embedded into the binary
(f6ce79b3f feat: embed kubeconform validation schemas into the binary),
external schema sources became strictly opt-in: ValidationExtraSchemas defaults
to an empty list and the embedded Kubernetes/CRD sources are always appended in
newKubeConformValidator. That made --local-resource-validation a no-op in the
default case and merely an override that nulls out whatever the user explicitly
asked for — the flag's only effect was schemaSources = nil, which duplicates
"don't pass extra schemas". Dropping it removes a redundant knob from the CLI
surface before it ships.

Key changes

CLI surface — cmd/nelm/common_flags.go

• Drops the --local-resource-validation flag registration from
  AddResourceValidationFlags, along with its global/local env var bindings.

Public options — pkg/common/options.go

• Removes the LocalResourceValidation bool field (json:"localResourceValidation")
  from ResourceValidationOptions.

Validator — pkg/resource/kubeconform.go, pkg/resource/validate.go

• newKubeConformValidator loses its embeddedSchemasOnly parameter and the
  schemaSources = nil short-circuit; it now always honors the caller-supplied
  sources plus the embedded ones.
• validateResourceSchemas updated to the two-argument signature.

Review focus / risks

• Breaking change to the exported API. ResourceValidationOptions is part of
  pkg/common, and newKubeConformValidator's signature changed. Confirm no
  downstream consumer (werf in particular) sets LocalResourceValidation or
  serializes/deserializes localResourceValidation in a persisted options
  payload — the JSON tag disappearing means any stored value is now silently
  ignored rather than rejected.
• Behavior change for anyone combining the two flags. Previously
  --resource-validation-extra-schema <src> --local-resource-validation ignored
  <src> and validated offline; now the extra source is used, which means
  network access where there was none. Verify that's the intended semantics and
  that no docs/README/e2e invocation relies on the old combination.
• Cache key. cacheSubDirName is derived from the joined schemaSources.
  With the flag gone the hash no longer depends on the (removed) offline mode, so
  a cache directory populated by an older binary run with
  --local-resource-validation plus extra schemas will now be reused under the
  same key with different effective sources. Worth confirming the
  --resource-validation-cache-lifetime expiry is
• Since the flag was only introduced on this release line and never released,
  double-check whether a changelog/migration note i